CVE-2026-0146: In mfc_core_get_dec_metadata_sei_nal of mfc_core_reg_api

Synopsis

An out-of-bounds write vulnerability exists in the Android kernel, specifically in the mfc_core_get_dec_metadata_sei_nal function of mfc_core_reg_api.c, which handles decoding of SEI NAL metadata in the MFC (Multi-Format Codec) media processing subsystem. The vulnerability is reachable over the network by a low-privileged authenticated user, with no victim interaction required. Successful exploitation gives the attacker full remote code execution within the kernel context, enabling complete control over confidentiality, integrity, and availability of the affected device. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable code path is reachable over the network, meaning an attacker must be able to send requests to the exposed service across the internet or an internal network.

• AuthenticationRequired

  A valid account with low-level privileges is sufficient to reach the vulnerable code path; no administrative or elevated credentials are needed.

• Victim interactionNot required

  No user or victim action (such as clicking a link or opening a file) is needed; the attacker can trigger the vulnerability entirely without victim participation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other unpredictable environmental factors.

Blast Radius

• The attacker achieves arbitrary code execution in the Android kernel context, giving full control over the compromised host.
• All data accessible to the kernel, including credentials, session tokens, and stored user data, can be read directly.
• The attacker can modify or corrupt kernel memory, persistent storage, and any data structures the kernel manages.
• The attacker can crash or destabilize the kernel, causing a device outage or forcing a reboot that disrupts running workloads.